template.yaml

---
AWSTemplateFormatVersion: '2010-09-09'
Transform: 'AWS::Serverless-2016-10-31'
Description: AWS AppSync Session Manager Recommendations - powered by Amazon Neptune

Parameters:
  ProjectName:
    Type: String
    Default: aws-appsync-session-manager

  NeptuneInstanceClass:
    Type: String
    Default: db.r4.large
    
Mappings:
  SubnetConfig:
    VPC:
      CIDR: '10.0.0.0/16'
    Public1:
      CIDR: '10.0.0.0/24'
    Public2:
      CIDR: '10.0.1.0/24'
    Private1:
      CIDR: '10.0.2.0/24'
    Private2:
      CIDR: '10.0.3.0/24'
    Lambda1:
      CIDR: '10.0.4.0/24'
    Lambda2:
      CIDR: '10.0.5.0/24'

Globals:
  Function:
    Runtime: nodejs8.10
    Handler: index.handler
    VpcConfig:
      SecurityGroupIds:
        - !Ref LambdaSecurityGroup
      SubnetIds:
        - !Ref LambdaSubnet1
        - !Ref LambdaSubnet2
    Environment:
      Variables:
        #NEPTUNE_ENDPOINT: aws-appsync-session-manager.cluster-cryqwigx1epw.us-east-2.neptune.amazonaws.com
        NEPTUNE_ENDPOINT: !GetAtt NeptuneCluster.Endpoint
        NEPTUNE_PORT: 8182
      

Resources:
  # ---- AppSync ----
  UserSessionRecommendationQueryResolver:
    Type: AWS::AppSync::Resolver
    Properties:
      ApiId:
        Fn::ImportValue:
          !Sub "${ProjectName}-sessions-manager-api"
      TypeName: Query
      FieldName: recommendations
      DataSourceName: !GetAtt UserRecommendationDataSource.Name
      RequestMappingTemplate: |
        {
          "version": "2017-02-28",
          "operation": "Invoke",
          "payload": {
            "userId": "$util.defaultIfNullOrEmpty($ctx.args.userId, $ctx.identity.sub)"
          }
        }
      ResponseMappingTemplate: |
        $util.toJson($ctx.result.sessions)

  UserRecommendationDataSource:
    Type: AWS::AppSync::DataSource
    Properties:
      ApiId:
        Fn::ImportValue:
          !Sub "${ProjectName}-sessions-manager-api"
      Name: SessionManager_recommendation_function
      Description: AppSync data source for recommendation Lambda function
      Type: AWS_LAMBDA
      ServiceRoleArn:
        Fn::ImportValue:
          !Sub "${ProjectName}-appsync-service-role-arn"
      LambdaConfig:
        LambdaFunctionArn: !GetAtt RecommendSessionsFunction.Arn


  # ---- Amazon Neptune ----
  # Two instance Amazon Neptune cluster, using default
  # parameter groups
  NeptuneCluster:
    Type: AWS::Neptune::DBCluster
    Properties:
      DBClusterIdentifier: !Ref ProjectName
      DBSubnetGroupName: !Ref NeptuneSubnets
      VpcSecurityGroupIds:
        - !Ref NeptuneSecurityGroup
      Tags:
        - Key: Name
          Value: !Sub "${ProjectName}-neptune-cluster"
        - Key: Project
          Value: !Ref ProjectName

  NeptuneInstance1:
    Type: AWS::Neptune::DBInstance
    Properties:
      DBClusterIdentifier: !Ref NeptuneCluster
      DBInstanceClass: !Ref NeptuneInstanceClass
      DBInstanceIdentifier: !Sub "${ProjectName}-neptune-1"
      DBSubnetGroupName: !Ref NeptuneSubnets
      Tags:
        - Key: Name
          Value: !Sub "${ProjectName}-neptune-instance-1"
        - Key: Project
          Value: !Ref ProjectName

  NeptuneInstance2:
    Type: AWS::Neptune::DBInstance
    Properties:
      DBClusterIdentifier: !Ref NeptuneCluster
      DBInstanceClass: !Ref NeptuneInstanceClass
      DBInstanceIdentifier: !Sub "${ProjectName}-neptune-2"
      DBSubnetGroupName: !Ref NeptuneSubnets
      Tags:
        - Key: Name
          Value: !Sub "${ProjectName}-neptune-instance-2"
        - Key: Project
          Value: !Ref ProjectName
  
  NeptuneSubnets:
    Type: AWS::Neptune::DBSubnetGroup
    Properties:
      DBSubnetGroupDescription: !Sub "${ProjectName} Subnet Group"
      DBSubnetGroupName: !Sub "${ProjectName}-subnet-group"
      SubnetIds:
        - !Ref PrivateSubnet1
        - !Ref PrivateSubnet2
      Tags:
        - Key: Name
          Value: !Sub "${ProjectName}-neptune-subnet-group"
        - Key: Project
          Value: !Ref ProjectName

  NeptuneSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    DependsOn: LambdaSecurityGroup
    Properties:
      GroupName: !Sub "${ProjectName}-neptune-security-group"
      GroupDescription: Allow access to Amazon Neptune from Lambda
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 8182
          ToPort: 8182
          SourceSecurityGroupId: !Ref LambdaSecurityGroup
      VpcId: !Ref VPC
      Tags:
        - Key: Project
          Value: !Ref ProjectName

  # --- Lambda ----
  SessionStreamFunction:
    Type: AWS::Serverless::Function
    DependsOn: NeptuneCluster
    Properties:
      CodeUri: session-stream/
      Description: Processes DynamoDB stream on sessions, writes to Neptune
      Policies:
        - VPCAccessPolicy: {}
      Events:
        Stream:
          Type: DynamoDB
          Properties:
            Stream:
              Fn::ImportValue:
                !Sub "${ProjectName}-sessions-stream"
            StartingPosition: LATEST
            BatchSize: 10
  
  ScheduleStreamFunction:
    Type: AWS::Serverless::Function
    DependsOn: NeptuneCluster
    Properties:
      CodeUri: schedule-stream/
      Description: Processes DynamoDB stream of user schedule, writes to Neptune
      Policies:
        - VPCAccessPolicy: {}
      Events:
        Stream:
          Type: DynamoDB
          Properties:
            Stream:
              Fn::ImportValue:
                !Sub "${ProjectName}-user-schedule-stream"
            StartingPosition: LATEST
            BatchSize: 10

  RecommendSessionsFunction:
    Type: AWS::Serverless::Function
    DependsOn: NeptuneCluster
    Properties:
      CodeUri: recommend/
      Description: Recommends sessions using data in Amazon Neptune
      Policies:
        - VPCAccessPolicy: {}
  
  LambdaSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupName: !Sub "${ProjectName}-lambda-security-group"
      GroupDescription: Access from AWS Lambda to Amazon Neptune
      SecurityGroupEgress:
        - IpProtocol: tcp
          FromPort: 0
          ToPort: 65535
          CidrIp: !FindInMap ['SubnetConfig', 'VPC', 'CIDR']
      VpcId: !Ref VPC
      Tags:
        - Key: Project
          Value: !Ref ProjectName

  AppSyncServicePolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: !Sub "${ProjectName}-appsync-recommendation-function-policy"
      Roles:
        - Fn::ImportValue:
            !Sub "${ProjectName}-appsync-service-role"
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action:
              - "lambda:InvokeFunction"
            Resource: !GetAtt RecommendSessionsFunction.Arn

  # ---- Networking Resources ----
  # A VPC with two public subnets and two private
  # subnets along with an internet gateway.
  VPC:
    Type: AWS::EC2::VPC
    Properties:
      EnableDnsSupport: true
      EnableDnsHostnames: true
      CidrBlock: !FindInMap ['SubnetConfig', 'VPC', 'CIDR']
      Tags:
        - Key: Name
          Value: !Sub "${ProjectName}-vpc"
        - Key: Project
          Value: !Ref ProjectName

  PrivateSubnet1:
    Type: AWS::EC2::Subnet
    Properties:
      AvailabilityZone: 
        Fn::Select: 
        - 0
        - Fn::GetAZs: !Ref AWS::Region
      VpcId: !Ref VPC
      CidrBlock:  !FindInMap ['SubnetConfig', 'Private1', 'CIDR']
      Tags:
        - Key: Name
          Value: !Sub "${ProjectName}-private-subnet-1"
        - Key: Project
          Value: !Ref ProjectName

  PrivateSubnet2:
    Type: AWS::EC2::Subnet
    Properties:
      AvailabilityZone: 
        Fn::Select: 
        - 1
        - Fn::GetAZs: !Ref AWS::Region
      VpcId: !Ref VPC
      CidrBlock:  !FindInMap ['SubnetConfig', 'Private2', 'CIDR']
      Tags:
        - Key: Name
          Value: !Sub "${ProjectName}-private-subnet-2"
        - Key: Project
          Value: !Ref ProjectName

  LambdaSubnet1:
    Type: AWS::EC2::Subnet
    Properties:
      AvailabilityZone: 
        Fn::Select: 
        - 0
        - Fn::GetAZs: !Ref AWS::Region
      VpcId: !Ref VPC
      CidrBlock:  !FindInMap ['SubnetConfig', 'Lambda1', 'CIDR']
      Tags:
        - Key: Name
          Value: !Sub "${ProjectName}-lambda-subnet-1"
        - Key: Project
          Value: !Ref ProjectName

  LambdaSubnet2:
    Type: AWS::EC2::Subnet
    Properties:
      AvailabilityZone: 
        Fn::Select: 
        - 1
        - Fn::GetAZs: !Ref AWS::Region
      VpcId: !Ref VPC
      CidrBlock:  !FindInMap ['SubnetConfig', 'Lambda2', 'CIDR']
      Tags:
        - Key: Name
          Value: !Sub "${ProjectName}-lambda-subnet-2"
        - Key: Project
          Value: !Ref ProjectName

  PrivateRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC

  PrivateRouteTable1Association:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref PrivateRouteTable
      SubnetId: !Ref PrivateSubnet1

  #---- Dev ----
  # For development purposes, including a public subtnet
  # and internet gateway. We will also build a Cloud9
  # instance.
  # PublicSubnet1:
  #   Type: AWS::EC2::Subnet
  #   Properties:
  #     AvailabilityZone: 
  #       Fn::Select: 
  #       - 0
  #       - Fn::GetAZs: !Ref AWS::Region
  #     VpcId: !Ref VPC
  #     CidrBlock:  !FindInMap ['SubnetConfig', 'Public1', 'CIDR']
  #     MapPublicIpOnLaunch: true
  #     Tags:
  #       - Key: Name
  #         Value: !Sub "${ProjectName}-public-subnet-1"
  #       - Key: Project
  #         Value: !Ref ProjectName

  # InternetGateway:
  #   Type: AWS::EC2::InternetGateway

  # GatewayAttachement:
  #   Type: AWS::EC2::VPCGatewayAttachment
  #   Properties:
  #     VpcId: !Ref 'VPC'
  #     InternetGatewayId: !Ref 'InternetGateway'

  # PublicRouteTable:
  #   Type: AWS::EC2::RouteTable
  #   Properties:
  #     VpcId: !Ref 'VPC'

  # PublicRoute:
  #   Type: AWS::EC2::Route
  #   DependsOn: GatewayAttachement
  #   Properties:
  #     RouteTableId: !Ref 'PublicRouteTable'
  #     DestinationCidrBlock: '0.0.0.0/0'
  #     GatewayId: !Ref 'InternetGateway'

  # PublicSubnet1RouteTableAssociation:
  #   Type: AWS::EC2::SubnetRouteTableAssociation
  #   Properties:
  #     SubnetId: !Ref PublicSubnet1
  #     RouteTableId: !Ref PublicRouteTable

  # Cloud9Env:
  #   Type: AWS::Cloud9::EnvironmentEC2
  #   Properties:
  #     Description: !Sub "Cloud9 Environment to developer ${ProjectName}"
  #     AutomaticStopTimeMinutes: 30
  #     InstanceType: t2.small
  #     Name: !Ref ProjectName
  #     SubnetId: !Ref PublicSubnet1

  # ---- Sample Data ----
  # SampleDataBucket:
  #   Type: AWS::S3::Bucket

  # NeptuneDataLoaderRole:
  #   Type: AWS::IAM::Role
  #   Properties:
  #     Path: /session-manager/
  #     AssumeRolePolicyDocument:
  #       Version: '2012-10-17'
  #       Statement:
  #         - Effect: Allow
  #           Principal:
  #             Service:
  #               - rds.amazonaws.com
  #           Action:
  #             - "sts:AssumeRole"
  #     Policies:
  #       - PolicyName: NeptuneDataLoaderPolicy
  #         PolicyDocument:
  #           Version: '2012-10-17'
  #           Statement:
  #             - Effect: Allow
  #               Action:
  #                 - "s3:Get*"
  #                 - "s3:List*"
  #               Resource:
  #                 - !GetAtt SampleDataBucket.Arn
  #                 - !Sub "${SampleDataBucket.Arn}/*"

  # VpcEndpoint:
  #   Type: AWS::EC2::VPCEndpoint
  #   Properties:
  #     VpcId: !Ref VPC
  #     RouteTableIds:
  #       - !Ref PrivateRouteTable
  #     ServiceName: !Sub "com.amazonaws.${AWS::Region}.s3"
  #     PolicyDocument:
  #       Version: '2012-10-17'
  #       Statement:
  #         - Effect: Allow
  #           Principal: '*'
  #           Action:
  #             - s3:Get*
  #             - s3:List*
  #           Resource:
  #             - !Sub "${SampleDataBucket.Arn}"
  #             - !Sub "${SampleDataBucket.Arn}/*"

#### OUTPUTS ####
Outputs:
  VpcId:
    Description: VPC ID
    Value: !Ref VPC

  NeptuneClusterEndpoint:
    Description: Endpoint for Neptune Cluster
    Value: !GetAtt NeptuneCluster.Endpoint

  NeptuneClusterReadEndpoint:
    Description: Read endpoint for Neptune Cluster
    Value: !GetAtt NeptuneCluster.ReadEndpoint
  
  # SampleDataBucket:
  #   Description: Name of the bucket to upload sample data to
  #   Value: !Ref SampleDataBucket

  # SampleDataLoaderRole:
  #   Description: ARN of Sample Data loader
  #   Value: !GetAtt NeptuneDataLoaderRole.Arn